Your agent reads SKILL.md. SkillsGuard reads it first.

Before an agent runs a skill, something should read it first. SkillsGuard is a static scanner built to be that something: a fast, local check on the SKILL.md-plus-scripts bundles that coding agents load to extend their own behavior.

What SkillsGuard scans and why skill packages are the target

SkillsGuard is a zero-runtime-dependency static security scanner for AI agent skill packages, the directory bundles built around a required SKILL.md plus optional scripts/ and references/, that agents such as Claude Code load to extend their behavior . It is MIT-licensed and requires Node ≥18.3, with an initial stable v1.0.0 release on June 19, 2026 and a v1.1.1 bump on June 21, 2026 .

The package is not yet published on npm. Installation today is a clone-and-build flow: git clone → npm install → npm run build → npm link . For developers who want to skip the local build, a free Cloudflare Worker-style API endpoint accepts curl-based scans, and the core scan itself runs offline: no hosted account, token, or LLM call required .

Why scan skills at all? The Agent Skills format, originally developed by Anthropic for cross-product reuse, widens the trust boundary at runtime through progressive disclosure. An agent sees only a skill's name and description at startup, loads the full SKILL.md when the context becomes relevant, and may then execute bundled scripts or pull in referenced resources during execution . Static inspection before any of that happens is what the scanner is for.

The output slots into existing toolchains. SkillsGuard emits both JSON and SARIF 2.1.0, and returns exit codes (0 for clean, 1 for findings, 2 for a usage error), so it composes with any CI pipeline that reads SARIF, including GitHub Code Scanning and GitLab . That makes it usable as a pre-commit hook, a CI gate, or, via its MCP stdio server, a tool an agent calls to vet unfamiliar skill content before trusting it.

Why scanning pays: malicious payloads in 26% of analyzed AI skill packages

The case for scanning skills before an agent loads them is empirical, not hypothetical. A January 2026 study (arXiv 2601.10338) analyzed 31,132 collected skills and found that 26.1% carried at least one vulnerability across 14 distinct patterns . Data exfiltration showed up in 13.3% of skills and privilege escalation in 11.8%, and packages that bundled executable scripts were 2.12× more likely to be vulnerable than instruction-only packages . Scripts carry more risk per package than prose-only bundles, but they account for less of the overall attack surface.

The largest behavioral study makes that point sharply. Researchers (arXiv 2602.06547) verified 98,380 skills from two community registries, narrowed them to 4,287 suspicious candidates, and confirmed 157 malicious skills carrying 632 vulnerabilities, an average of 4.03 each, with 71.8% rated Critical or High . More relevant for scanner design: 84.2% of those vulnerabilities lived in the natural-language SKILL.md file, not in code . A scanner that only inspects scripts misses the bulk of the attack surface.

Snyk's ToxicSkills survey of 3,984 community skills found 36% with security flaws and reported that 91% of confirmed malicious skills used prompt injection as the primary vector, a prose-level attack rather than a binary payload . Snyk also noted that daily skill submissions climbed from under 50 in mid-January to over 500 within six weeks, so the exposed surface is growing faster than manual review can absorb .

The pattern across all three datasets is consistent: most malicious content hides in instructions, not scripts. Natural-language rule coverage matters as much as code-pattern matching, which explains how SkillsGuard splits its 151 detection rules across both prose-level threats (prompt injection, scope creep, secret harvesting) and code-level ones (command injection, persistence, obfuscation) rather than treating skill scanning as a code-only problem .

SkillsGuard's 15 threat categories, annotated

SkillsGuard groups its 151 detection rules into 15 categories that map directly onto how a malicious skill actually behaves: some in prose, some in code. The prose-level set covers prompt injection, scope creep, and secret harvesting; the code-level set covers command injection, exfiltration, supply chain, persistence, privilege escalation, filesystem abuse, network, and obfuscation; and four targeted sets cover PowerShell, Docker, Ruby, and model-specific patterns . That split matters because behavioral verification of community skills found 84.2% of vulnerabilities living in natural-language SKILL.md text rather than executable code .

The technical choice that raises the floor is decode-first preprocessing. Before any pattern runs, SkillsGuard decodes base64, hex, and unicode escapes, so a payload hidden inside an encoded string is matched against the same rules as plaintext . Surface-string regex scanners that match raw bytes miss exactly this class of trivial obfuscation, and encoded blobs are a flagged category in their own right.

For MCP-connected toolchains, the stdio server adds a useful surface. SkillsGuard exposes scan_skill and scan_skills_dir as MCP tools, so an agent can call the scanner from inside its own toolchain to pre-screen an unfamiliar skill before loading it, closing the in-agent trust loop rather than relying on an out-of-band check .

"Static analysis with decode-first preprocessing, no LLM calls in the core scan." SkillsGuard project README (source: Teycir/SkillsGuard).

None of this requires a hosted account or an LLM call. The core scan is offline-first with zero runtime dependencies on Node >=18.3, and the Cloudflare Worker-style API endpoint is opt-in for curl-based scans, not a dependency . That suits airgapped CI and developers who want determinism over a network round-trip.

Getting SkillsGuard operational: clone, pre-commit hook, and stdio pipe

SkillsGuard is not on npm yet, so installation is a source build: clone the repo, install dev dependencies, compile, and link the CLI globally. It targets Node 18.3 or newer and ships with zero runtime dependencies, so a scan makes no outbound call and emits no telemetry . The four-step path is short:

git clone https://github.com/Teycir/SkillsGuard
cd SkillsGuard
npm install
npm run build
npm link

Once linked, the most common deployment is a pre-commit hook that blocks any commit introducing malicious skill content before it reaches the remote. For large monorepos, git-diff/staged mode scans only changed files instead of the whole skills corpus, which keeps CI feedback fast and avoids re-scanning thousands of unchanged SKILL.md bundles on every push .

Two workflows make retrofitting realistic rather than noisy. Watch mode monitors a skills directory live and re-scans on change, useful during active development. The baseline workflow snapshots current findings as known-clean, then alerts only on new violations, which is the practical way to adopt the scanner against an existing corpus without drowning a team in pre-existing flags on day one . The scanner returns standard exit codes (0 for clean, 1 for findings, 2 for usage errors), so it slots into shell pipelines and CI gates without custom parsing .

For output, SkillsGuard emits both SARIF and JSON. SARIF integrates directly with GitHub Advanced Security and GitLab dependency scanning, surfacing findings as code-scanning alerts in the merge request UI, while JSON is the machine-readable feed for custom alerting or dashboards . Beyond CI, the project exposes an MCP stdio server with scan_skill and scan_skills_dir tools, so an agent can pipe an unfamiliar skill through the scanner before trusting it, moving the check from the developer's commit to the agent's own load path .

Not the first mover: SkillsGuard vs. Cisco AI Defense and SkillSpector

SkillsGuard is not the first scanner for AI skill packages; the commit history settles the question. By the time SkillsGuard's v1.0.0 landed on June 19, 2026, at least two production scanners already shipped: Cisco AI Defense's Skill Scanner reached its open-source release on January 28, 2026, and NVIDIA's SkillSpector followed on May 11, 2026. The defensible claim is narrower: SkillsGuard is the most developer-accessible zero-dependency offline option in a field that now holds at least four active scanners.

The split is architectural. Cisco's Skill Scanner pairs YAML/YARA pattern detection with an LLM-as-judge stage and behavioral dataflow analysis, semantic depth that SkillsGuard deliberately trades away for offline, deterministic operation. NVIDIA's SkillSpector ships 64 vulnerability patterns across 16 categories, roughly 11 static analyzers, an optional LangGraph/LLM semantic stage, OSV.dev dependency lookups, and SARIF 2.1.0 export (guide, 2026-06). GoPlus AgentGuard, at v1.1.28 on June 16, 2026, takes a three-layer route (hook-based auto-guard, on-demand deep scan with 24 detection rules, and runtime action blocking), plus Web3/wallet-drain rules SkillsGuard does not cover.

SkillsGuard's own README names SkillSpector as its closest architectural comparison: the framing here is offline, deterministic, zero-runtime-dependency static analysis, not semantic reasoning (source: SkillsGuard README).

Read together, the four tools occupy different points on the speed-accuracy-cost curve. Cisco and SkillSpector buy semantic depth at the cost of an LLM call and a hosted or heavier setup; AgentGuard adds runtime enforcement and chain-specific rules; SkillsGuard optimizes for a fast, no-account, no-token gate that runs identically on a laptop and in CI (skillguard.dev). "Newest and lightest" is the honest pitch, not "first."

Where SkillsGuard can't follow: semantic intent and cross-modal evasion

SkillsGuard's deterministic regex engine is structurally blind to one whole class of attack: a mismatch between what a skill's natural-language instructions say and what its bundled code actually does. Static pattern matching reads tokens, not intent, so an attack split across a benign-looking SKILL.md and a separately innocuous script can pass each file individually while combining into something malicious. SkillMutator (arXiv 2606.14154) quantifies the gap: against its cross-modal language-and-code attacks, open-source scanners detected only 2–8% and commercial scanners only 9–17% . A fast local gate is not where that evasion class gets caught.

Even adding an LLM stage does not fully close it. MalSkillBench (arXiv 2606.07131, published June 5, 2026) released 3,944 malicious and 4,000 matched benign skills across a 108-cell taxonomy and reported a code-injection verification yield of 94.5% but a prompt-injection yield of only 75.8%, and that ceiling is for LLM-assisted scanning, not static-only checks . The authors frame the core problem directly:

"Skill detection is neither pure malware scanning nor pure prompt-injection filtering." MalSkillBench authors, arXiv 2606.07131 (source: skillguard.dev).

The approach that works puts cheap static checks first and saves semantic reasoning for what gets through. SkillSieve (arXiv 2604.06550, revised May 26, 2026) describes a three-layer pipeline: a cheap static pre-filter, then LLM subtasks, then a three-model jury, reaching F1=0.920 at roughly $0.006 per skill . SkillsGuard covers that first layer and nothing past it.

Several threat shapes sit entirely outside static reach:

• Delayed activation: payloads that stay dormant until a runtime trigger no regex can observe.
• Multimodal hidden instructions: directives embedded in referenced assets rather than scannable text.
• Agent-control-plane manipulation: instructions that bend the agent's own tool-use behavior instead of running obvious shell payloads.
• Templated brand impersonation: in one behavioral study, a single actor accounted for 54.1% of confirmed malicious skills through cloned, trusted-looking templates that read as legitimate to a pattern matcher .

None of this argues against running SkillsGuard. It argues against treating a green scan as a clearance for high-privilege or untrusted skills. The deterministic gate catches the obvious; the literature is clear that intent, timing, and cross-file composition need semantic or runtime layers behind it.

SkillsGuard as a CI gate: what it blocks and what needs more scrutiny

SkillsGuard fits best as a fast, offline gate in CI or a pre-commit hook, where it reliably flags reverse shells, curl-to-shell payloads, encoded blobs, exfiltration hooks, persistence scripts, and hardcoded secrets without a network call or LLM budget. The scan runs with zero runtime dependencies on Node 18.3 or later, emits JSON and SARIF, and returns exit code 1 on findings so a pipeline can fail the build deterministically . That makes it cheap to wire into the same stage that already runs your linters.

A clean pass means the obvious patterns are absent, not that the skill is fully safe. The deterministic engine catches the recognizable issues; it does not establish that a skill is safe to grant high privilege. Skills with file, network, or shell access still warrant sandboxed execution, a manual read of the SKILL.md, or a semantic layer before production trust, because 84.2% of confirmed vulnerabilities in one behavioral study lived in natural-language SKILL.md text, not code , and benchmark work shows static-only scanners catch as little as 2%–8% of cross-modal language-and-code attacks .

A layered approach follows from this. Run SkillsGuard as the fast local gate, expose its MCP stdio server to pre-screen an unknown skill before an agent loads it, then escalate high-privilege or untrusted skills to human review or a semantic pass such as NVIDIA's SkillSpector or Cisco AI Defense's behavioral scanner .

The practical upshot: the first layer ships in under an hour and stops the noisy, scriptable attacks. Pair it with sandboxing and a semantic or runtime check for anything you'd give real access to, and treat a green checkmark as a starting point, not a clearance.

Frequently asked questions

What is an AI agent skill package, and why can it run arbitrary code?

A skill package is a directory built around a required SKILL.md manifest (YAML frontmatter plus Markdown instructions) with optional scripts/, references/, and assets/ folders . The execution risk comes from how agents consume it: at startup the agent reads only the skill's name and description, then progressively loads the full SKILL.md when a task seems relevant and may run bundled scripts or pull in referenced resources mid-execution . That progressive disclosure means the trust boundary widens at runtime, not at install time; code you never inspected can execute once the agent decides the skill applies.

How is SkillsGuard different from NVIDIA SkillSpector?

SkillsGuard is a static, offline-first scanner with 151 detection rules across 15 categories, zero runtime dependencies, and an MCP stdio server (scan_skill, scan_skills_dir) so an agent can scan unfamiliar content before trusting it . NVIDIA's SkillSpector covers 64 vulnerability patterns across 16 categories and adds an optional LangGraph/LLM semantic stage plus OSV.dev dependency lookups, with SARIF 2.1.0 export . The practical split: SkillsGuard stays deterministic and self-contained for fast CI gating, while SkillSpector reaches for semantic depth and supply-chain checks. SkillsGuard's own README names SkillSpector as its closest prior art .

Does SkillsGuard catch prompt injection attacks in natural-language SKILL.md files?

Partially. SkillsGuard includes prompt-injection rules and uses decode-first preprocessing rather than raw regex, which helps surface obfuscated instructions . But the limit is structural: even LLM-assisted scanners reach only about 75.8% yield on prompt injection in MalSkillBench testing, versus 94.5% on code injection . This matters because one behavioral study found 84.2% of confirmed vulnerabilities lived in the natural-language SKILL.md rather than in code . Static regex alone will miss semantic intent manipulation in pure prose; supplement it with human review for untrusted community skills.

Why is SkillsGuard not on npm yet, and how do I install it?

SkillsGuard is still at a pre-v1.2 tooling stage and is not yet published to npm, so installation is a local build . The path is git clone → npm install → npm run build → npm link, and it requires Node ≥18.3 . If you would rather not build locally, a curl-friendly hosted API endpoint is offered as an alternative for one-off scans, though the core scan runs fully offline with no account, token, or LLM call .

What percentage of public AI skills contain malicious content?

It depends on methodology, and the gap between figures is the point. Behavioral verification of 98,380 skills confirmed 157 malicious ones, or 0.16% . Static analysis of 31,132 skills found 26.1% carried at least one vulnerability pattern , and Snyk's ToxicSkills scan of 3,984 skills reported 36% with security flaws . Static-scan percentages run higher because they count rule matches (potential issues), not confirmed malicious intent. Read the low number as "verified bad actors" and the high numbers as "needs a closer look."